This invention relates to web addresses and hyperlinks, and more particularly, to a method for detecting fake web addresses and hyperlinks.
A hyperlink is an element in an electronic document that links to another place in the same document or to an entirely different document. The hyperlink may be within any electronic document, such as a web page, an email, a word processing document, a spreadsheet or the like. With respect to the Internet, the hyperlink may be a network address or domain name of a web site that may be embedded in an object, such as a word, phrase, icon or picture. These objects are commonly known as hyperlinked objects.
Web pages and other resources on the World Wide Web are identified by unique URLs (Uniform Resource Locator) or addresses. The network address or IP address is an identifier for a computer or device on a TCP/IP network. Networks using the TCP/IP protocol route messages based on the IP address of the destination. The format of an IP address is a 32-bit numeric address written as four numbers separated by periods. Each number can be zero to 255. For example, 1.160.10.240 could be an IP address.
A domain name is a name that identifies one or more IP addresses. For example, the domain name <ibm.com> may have one or more IP addresses associated with it. Every domain name has a suffix that indicates the top level domain (TLD) to which it is associated (e.g., .com, .org or .net). The Internet functions based on the IP address and not domain name such that a Domain Name System (DNS) server is needed to translate domain names into IP addresses.
Once a hyperlinked object is activated, an Internet relationship may be established by a Web browser or the like. The hyperlinked object itself may be the symbol representing the web site, the name of the web site, the domain name of the web site or any desired representation. For example, the hyperlinked object for IBM's web site may be the IBM symbol, the name IBM or the domain name <www.ibm.com>.
An Internet user may be sent to a fake web site through the use of fake hyperlinks. For example, a hyperlinked object may display the name <www.ibm.com> while the domain name associated with the object is actually <www.1bm.com> with the number “1” used in place of the letter “i”. The HTML syntax for such a fake hyperlink may be:
<a href=http://www.1bm.com/>www.ibm.com</a>.
The hyperlink appears as www.ibm.com while the domain name is actually http://www.1bm.com. As the number “1” is similar in appearance to the letter “i”, the unsuspecting user may not realize that they are being routed to a fake web site instead of the actual web site. The fake web site could be a doctored version of the actual web site that is used to gather and exploit the user's sensitive information. This activity is known as phishing.